US7756843B1 - Identifying and processing confidential information on network endpoints - Google Patents

Abstract

An automated method for identifying confidential information may include inputting a search term based on a set of policy rules into a search engine, and causing the search engine to perform a search based on the search term. The method may also include analyzing search results obtained from the search engine against the policy rules to identify the search results containing confidential information.

Description

BACKGROUND

1. Field of the Invention

Implementations consistent with the principles of the invention relate generally to data processing and, more particularly, to identifying and processing confidential information on network endpoints.

2. Description of Related Art

Organizations are continuously looking to prevent information leakage from their internal networks and endpoints (e.g., devices connected to the networks). Information leakage may include sending confidential information from people legitimately using a network or endpoint to people outside of the organization. This is a problem for organizations due to increasing internal and external compliance requirements, the need to protect intellectual property, and the need to prevent unauthorized disclosure of sensitive information.

Some organizations use firewalls that block content based upon information stored in a policy server that is deemed to be confidential. Such systems are difficult to update because the confidential information to be blocked by the firewall needs to be manually entered into the policy server. Manual policy entry is time consuming and may disclose confidential information to people in the organization who should not have access to such information.

Some organizations use proprietary custom search engines that work in conjunction with a policy server to search specific devices connected to the organizational network. However, such arrangements only work well if the information being searched does not change and information is stored in appropriate locations accessible to the organizational network. Such arrangements do not work if information is stored locally on a network endpoint (e.g., on a hard drive of a laptop) because the network server(s) may be unaware of such information. The network server(s) also cannot retrieve such information unless the user of the local information decides to disclose such information to the network server(s). The arrangements also fail to prevent a network endpoint from sending confidential information outside of the network control via external networks (e.g., emailing confidential information via the Internet from a non-corporate email account to a personal email account, e.g., hotmail account). Furthermore, the custom search engines of these systems provide inaccurate results.

SUMMARY

According to one aspect, a computer-readable medium may store computer-executable code for identifying confidential information. The code may include instructions to determine the availability of a search engine or search engines, instructions to select a search engine from the available search engines. The code may also include instructions to input a search term based on a set of policy rules into the selected search engine and cause the selected search engine to perform a search based on the search term. The code may further include instructions to analyze the search results obtained from the selected search engine against the policy rules, and instructions to identify the search results as containing confidential information based on analyzing the search results against the policy rules.

According to another aspect, a device for identifying confidential information may include a memory and a processor connected to the memory. The processor may be configured to identify a search engine from available search engines, input a search term based on a set of policy rules into the identified search engine and cause the identified search engine to perform a search based on the search term, and identify search results obtained from the identified search engine that contain confidential information based on the policy rules.

According to yet another aspect, an automated method for identifying confidential information may include inputting a search term based on a set of policy rules into a search engine, causing the search engine to perform a search based on the search term, and analyzing search results obtained from the search engine against the policy rules to identify the search results containing confidential information.

According to yet another aspect, a system for identifying confidential information may include means for selecting a search engine from the available search engines, means for inputting a search term based on a set of policy rules into the selected search engine, and means for analyzing search results obtained from the selected search engine against the policy rules to identify the search results containing confidential information.

According to still a further aspect, a computer-readable medium may store computer-executable code for processing a document. The code may include instructions to identify a document that a user is attempting to transmit, instructions to determine that the document contains confidential information, and instructions to selectively permit transmission of the document.

According to still another aspect, a computer-readable medium may store computer-executable code for processing a document identified using a search engine and search terms based on a set of policy rules. The code may include instructions to identify a document that a user is attempting to transmit, instructions to determine whether the document violates the policy rules, and instructions to selectively permit transmission of the document if the document violates the policy rules and permit transmission if the document complies with the policy rules.

According to another aspect, a system for processing confidential information may include a rule generator to receive confidential information from a plurality of devices that identify the confidential information using a search engine and search terms based on a set of policy rules. The rule generator may also create updated policy rules based on the confidential information received from the devices. The system may further include a policy server to receive the updated policy rules from the rule generator, and send the updated policy rules to the devices.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate an embodiment of the invention and, together with the description, explain the invention. In the drawings,

FIG. 1 is an exemplary diagram of a network in which systems and methods consistent with the principles of the invention may be implemented;

FIG. 2 is an exemplary block diagram of a device that may correspond to a client, network device, and/or server ofFIG. 1;

FIG. 3 is a diagram of a portion of an exemplary computer-readable medium that may be used by the device ofFIG. 2;

FIGS. 4A-4D provide a flowchart of an exemplary operation for processing confidential information according to an implementation consistent with the principles of the invention; and

FIGS. 5 and 6 are diagrams of exemplary implementations consistent with the principles of the invention.

DETAILED DESCRIPTION

The following detailed description of the invention refers to the accompanying drawings. The same reference numbers in different drawings may identify the same or similar elements. Also, the following detailed description does not limit the invention. Instead, the scope of the invention is defined by the appended claims and equivalents.

Implementations consistent with the principles of the invention relate to identifying and processing confidential information stored on network endpoints. As used herein, the term “network endpoint” refers to any device capable of connecting to a network via wired, wireless, and/or optical connections. Instead of using a proprietary content filtering engine and building a large software platform to download to network endpoints, an implementation consistent with the principles of the invention may provide network endpoint software that searches for and identifies confidential information using one or more desktop search engine software packages. The search results may be used to prevent leakage of confidential information from a specific network endpoint, and to educate the network to prevent other network endpoints from disclosing the same or similar confidential information.

Exemplary Network

FIG. 1 is an exemplary diagram of anetwork100 in which systems and methods consistent with the principles of the invention may be implemented. Network100 may include aclient110, anetwork device120, apolicy server130, an Internet Service Provider (ISP)server140, arule generator150, aprivate network160, and apublic network170. Twoclients110, and asingle network device120,policy server130, andISP server140 have been illustrated inFIG. 1 for simplicity. In practice, there may bemore clients110,network devices120,policy servers130, and/orISP servers140. Also, in some instances,client110 may perform a function of aserver130/140 and/or aserver130/140 may perform a function ofclient110.

As shown inFIG. 1,client110 may connect toprivate network160 vianetwork device120.Policy server130 andrule generator150 may connect tonetwork device120 viaprivate network160.Private network160 may include a local area network (LAN), a private network, such as a company intranet, or another type of network.Private network160 may also include organizational components, devices, servers, etc. (not shown inFIG. 1).Client110 may connect topublic network170 vianetwork device120.ISP server140 and other external client(s)110 may connect tonetwork device120 viapublic network170.Public network170 may include a wide area network (WAN), a telephone network, such as the Public Switched Telephone Network (PSTN), the Internet, or a combination of networks.

Client110 andservers130/140 may each include a device, such as a personal computer, a wireless telephone, a personal digital assistant (PDA), a lap top, or another type of computation or communication device, or a process running on one of these devices. In one implementation,client110 and/orservers130/140 may take the form of a provider of network content, such as a file, a web page, an email, or an instant message.

Network device120 may include a data transfer device, such as a gateway, a router, a switch, a firewall, a bridge, a proxy server, or some other type of device that processes and/or transfers data. In one implementation,network device120 may operate on data on behalf of an organizational network, such asorganizational network180. For example,network device120 may receive all, or substantially all, data destined fororganizational network180 and/or transmitted byorganizational network180.

Policy server130 may include a server, or a set of servers, that contain policy information. Policy information may include, for example, a condition for a user/application system to access a resource. The policy information may be parsed into policy rules having the following general format: if (condition) then (action). Policy rules may be set to prevent confidential information from being distributed outside oforganizational network180 or within organizational network180 (e.g., to users not authorized to view such confidential information). “Confidential information” may take the form of a document that contains private information (e.g., word(s), document type, document name(s), file(s), code name(s), a string of characters (e.g., a credit card number, a social security number, an address, etc.)), inappropriate content (e.g., profanity, pornography, etc.), detrimental content (e.g., viruses, spyware, etc.), and/or anything else that violates the policy rules of an organization. Policy rules may include rules that particular information cannot be sent outside the organizational network or that certain information cannot be downloaded to a client on the organizational network.

A “document,” as the term is used herein, is to be broadly interpreted to include an application, a program, an email, a portion of an email, a series of emails, an instant message, a portion of an instant message, a series of instant messages, a file, a portion of a file, a combination of files, combinations of any of the aforementioned, etc.

Policy server130 may cause one or more operations to be performed byclient110 based on policy rules.Client110 may operate a policy rule client process that may interact with a policy rule server process operating onpolicy server130. Generally,client110 may perform a service, such as check for confidential information violating a policy rule, with regard to a document contained onclient110.Client110 may perform the service and provide the results topolicy server130.Client110 may use the results in determining, for example, whether to permit the document to be transmitted fromclient110.

Organizational network180 may include arule generator150 that collects information fromorganizational network180 and provides this information as training data to a model. The model may generate new policy rules and/or modify existing policy rules (“updated policy rules”) based upon the training data, and send the updated policy rules topolicy server130.Rule generator150 may be part ofpolicy server130 or another device provided inprivate network160 oforganizational network180.

Exemplary Device Architecture

FIG. 2 is an exemplary block diagram of a device, which may correspond toclient110,network device120,policy server130,ISP server140, and/orrule generator150. The device may include abus210, aprocessor220, amain memory230, a read only memory (ROM)240, astorage device250, aninput device260, anoutput device270, and acommunication interface280.Bus210 may include a path that permits communication among the elements of the device.

Processor220 may include a processor, microprocessor, or processing logic that may interpret and execute instructions.Main memory230 may include a random access memory (RAM) or another type of dynamic storage device that may store information and instructions for execution byprocessor220.ROM240 may include a ROM device or another type of static storage device that may store static information and instructions for use byprocessor220.Storage device250 may include a magnetic and/or optical recording medium and its corresponding drive.

Input device260 may include a mechanism that permits an operator to input information to the device, such as a keyboard, a mouse, a pen, voice recognition and/or biometric mechanisms, etc.Output device270 may include a mechanism that outputs information to the operator, including a display, a printer, a speaker, etc.Communication interface280 may include any transceiver-like mechanism that enables the device to communicate with other devices and/or systems.

The device, consistent with the principles of the invention, may perform certain operations, as described in detail below. The device may perform these operations in response toprocessor220 executing software instructions contained in a computer-readable medium, such asmemory230. A computer-readable medium may be defined as a physical or logical memory device and/or carrier wave.

The software instructions may be read intomemory230 from another computer-readable medium, such asdata storage device250, or from another device viacommunication interface280. The software instructions contained inmemory230 may causeprocessor220 to perform processes that will be described later. Alternatively, hardwired circuitry may be used in place of or in combination with software instructions to implement processes consistent with the principles of the invention. Thus, implementations consistent with the principles of the invention are not limited to any specific combination of hardware circuitry and software.

Exemplary Computer-Readable Medium

FIG. 3 is a diagram of a portion of an exemplary computer-readable medium300 that may be used by a device, such as the device ofFIG. 2. In one implementation, computer-readable medium300 may correspond tomemory230 ofclient110. The portion of computer-readable medium300 illustrated inFIG. 3 may include anoperating system310,search engine software320, and/orpolicy controller software330.Software320/330 may be included inoperating system310 or may be separate fromoperating system310.

Operating system310 may include operating system software, such as the Microsoft Windows®, Apple MAC OS®, Linux®, Unix®, or IBM OS/2® operating systems, or an operating system for a personal digital assistant, a cell phone, or another type of communication device.

Search engine software320 may include any desktop search software, such as Google™ Desktop Search, Yahoo!® Desktop Search, Windows® Desktop Search, Apple® Spotlight, Copernic® Desktop Search, and/or desktop search software available from AOL®, Lycos®, AskJeeves®, Blinkx, Intellext, X1 Technologies, and Autonomy. Desktop search software differs from web-based search engines in the types of applications they support, but basically works in the same manner as web-based counterparts. Desktop search software may scan the contents of local and/or network-connected memory devices and build an index of the information by keyword or phrase. For example, the desktop search software may permit the contents of email, webmail, instant messages, and/or documents to be searched.

Policy controller software330 may include an executable object or process.Client110 may obtain the executable object or process from a server (e.g.,policy server130 or a server connected to network160) or from a third party, such as a third party server, disk, tape, network, CD-ROM, etc. Alternatively, the executable object or process may be pre-installed onclient110.

Ifpolicy controller software330 is not installed onclient110, thensoftware330 may be automatically installed onclient110 whenclient110 attempts to connect toorganizational network180, andorganizational network180 recognizes thatsoftware330 is not installed onclient110.Software330 may be updated byorganizational network180 in a similar manner iforganizational network180 recognizes thatsoftware330 is outdated.

Policy controller software330 may provide a searching aspect, an updating aspect, and an enforcement aspect. In the searching aspect,policy controller software330 may select a search engine(s) from availablesearch engine software320, instruct the search engine(s) to search for confidential information, and/or analyze the results of the search. In the updating aspect,policy controller software330 may determine if the search result(s) are on a “blacklist” of confidential information, and/or utilize the search results to update the policy rules. In the enforcement aspect,policy control software330 may determine whether a document is on the “blacklist” of confidential information, analyze a new document to see if it violates the policy rules, and/or control transmission of any confidential information.

Policy controller software330 may be automatically activated upon initiation of the operating system.Policy controller software330 may also be automatically activated whenclient110 attempts to connect to anetwork device120, or whenclient110 attempts to transmit information to a network, such asnetwork170, or to a removable media (e.g., ROM device, static storage device, a magnetic and/or optical recording medium). Alternatively,policy controller software330 may be activated when instructed by a user. In any case,policy controller software330 may identify and process confidential information, as will be described below.

Exemplary Processing

FIGS. 4A-4D provide a flowchart of an exemplary operation for identifying and processing confidential information located on network endpoints according to an implementation consistent with the principles of the invention. The processing ofFIGS. 4A-4D may begin upon initiation of the operating system ofclient110, whenclient110 attempts to connect to anetwork device120, whenclient110 attempts to transmit information to a network or removable media, or when instructed by a user ofclient110. In one implementation, the processing ofFIGS. 4A-4D may be performed by one or more software and/or hardware components withinclient110,policy server130, and/orrule generator150. In another implementation, the processing may be performed by one or more software and/or hardware components within another device or a group of devices separate from or includingclient110,policy server130, and/orrule generator150.

FIG. 4A shows the searching aspect in accordance with an implementation of the invention. As shown,policy controller software330 may decide whether it is time to search client110 (block405). The timing of a search may be set at any interval and/or event, e.g., when a user stops typing, attempts to connect toorganizational network180, closes an application, at predetermined time intervals, etc.Policy controller software330 may determine what search engine(s) are available on client110 (block410). For example,software330 may examinesearch engine software320.Software330 may download and/or install search engine software if no such software is available onclient110 or if additional search engine software is desired.Policy controller software330 may select one or more available search engine software packages from search engine software320 (block415). For example,software330 may select a search engine software package from within any of thesearch engine software320 discussed above, and may choose more than one search engine software package, if multiple search engines are available onclient110.

Policy controller software330 may input search term(s) into the selected search engine(s) (block420). For example,software330 may input search term(s) based, for example, on information received frompolicy server130 and cause the search engine(s) to perform a search based on the search term(s). The inputting of search term(s) and performance of a search may be repeated for different search term(s).Policy controller software330 may gather the search result(s) (block425). For example,software330 may gather search result(s) from each search that is performed.

As further shown inFIG. 4A, after the search engine(s) conducts a search,policy controller software330 may analyze the search result(s) against the policy rules (block430). For example,software330 may determine whether any of the search result(s) violates the policy rules (e.g.,software330 may determine the probability that the search result(s) includes confidential information).Policy controller software330 may identify the search result(s) that likely contain confidential information based on the analysis against the policy rules (block435). For example,software330 may score search result(s) based on the policy rules.Software330 may determine a confidence level that the search result(s) contains confidential information.Software330 may set the confidence level based, for example, on the number of times a search term appears in a document and set a threshold at which the confidence level may exceed before the document is deemed to be “blacklisted”. The threshold may be set low to be extra cautious. “Blacklist” or “blacklisted” material may include any document that an organization deems to contain confidential information.

Policy controller software330 may create and/or update the “blacklist” of results that may contain confidential information (block440). For example,software330 may create a “blacklist” from the search result(s) and/or supplement an existing “blacklist.” A “blacklist” may take the form of a listing of document(s) that have been determined to contain confidential information.

FIG. 4B shows the updating aspect in accordance with an implementation of the invention. As shown,policy controller software330 may determine whether a search result is listed on the “blacklist.” If the search result is already listed on the “blacklist” (block445—YES), thensoftware330 may check other search results. The updating aspect for such a search result need not occur because it is already known byorganizational network180.

If the search result is not listed on the “blacklist” (block445—NO), then,software330 may send the search result(s) to rule generator150 (block450). This may occur at any time interval, e.g., thenext time client110 connects toorganizational network180.Rule generator150 may receive the search result, analyze the information contained in the search result (e.g., provide the information as training data to a model) (block455), and generate new policy rules and/or modify existing policy rules (“updated policy rules”) based on the new information (block460).Rule generator150 may transmit the updated policy rules topolicy server130.Client110 may receive the updated policy rules from policy server130 (block465).Policy server130 may decide whether to provide the updated policy rules toother clients110 connected to organizational network180 (block465). Transmission of the updated policy rules bypolicy server130 may occur at any time interval, e.g., the next time a client connects toorganizational network180.

In another implementation,policy controller software330 may generate new policy rules and/or modify existing policy rules itself. For example,software330 may add the search result(s) to its own training data (e.g., to train its model to generate new policy rules and/or modify existing policy rules (“updated policy rules”) based on any new information). In this case,policy controller software330 may send the updated policy rules to other client(s)110. For example,software330 may transmit the updated policy rules topolicy server130 for distribution toother clients110 oforganizational network180. Alternatively,software330 may send the updated policy rules to theother clients110 itself.

FIG. 4C shows the enforcement aspect in accordance with an implementation of the invention. As shown, if aclient110 attempts to transmit a document (block470), thenpolicy controller software330 may determine whether the document is on the “blacklist” (block475). “Transmit” or “transmission” of content may include any form of transmission, such as via email, via instant message, as an attachment to email and/or instant message, computer-computer transfer, storage to an external/removable memory, printing to a printer, etc. If the document is on the “blacklist” (block475—YES), thenpolicy controller software330 may selectively permit transmission of the document (block480). For example,software330 may completely block transmission of the document by preventing transmission of the document throughout an organization and/or outside an organization.Software330 may also put restrictions on the use of the document. For example,software330 may preclude transmission of the document to certain individuals, or allow the document to be transmitted within the entire organization, but preclude transmission outside the organization. In one implementation, if the user is attempting to transmit the document withinorganizational network180, the transmission may be permitted depending upon to whom the user is transmitting the document. Otherwise,software330 may block transmission of the document.

Software330 may also provide information to the user about the reason for blocking the transmission. For example,software330 may inform the user about what is happening to the document (e.g., blocked, quarantined, deleted, etc.).Software330 may also inform the user how to legitimately distribute the document (e.g., may only send to certain users, may only use internally, etc.).Software330 may also notifyorganizational network180 of this violation. This would enableorganizational network180 to pinpoint potential policy violations and have a record of such violations.

As further shown inFIG. 4C, if the document is not on the “blacklist” (block475—NO), thenpolicy controller software330 may permit transmission of the document (block485).Software330 may allow use of the document because it does not contain confidential information, and may permit transmission of the document throughout an organization and/or outside an organization.

FIG. 4D shows another implementation of the enforcement aspect. As shown, if aclient110 attempts to transmit a document (block470), thenpolicy controller software330 may analyze the document (or series of documents) against the policy rules (block490). Analysis of a series of documents is intended to prevent transmission of confidential information that is contained in multiple documents (e.g., multiple emails or instant messages), where each single document would not violate the policy rules, but the documents together would violate the policy rules. For example,software330 may analyze the document (and/or series of documents) to see if they contain confidential information alone and/or in combination.

Policy controller software330 may determine whether there is a policy violation (block495). For example,software330 may determine whether the information contained in the document(s) violates the policy rules (e.g., whether the probability of the document(s) including confidential information exceeds a predetermined threshold). If the document(s) violates the policy rules (block495—YES), thenpolicy controller software330 may selectively permit transmission of the document (block480), as discussed above forFIG. 4C. If the document(s) does not violate the policy rules (block495—NO), thenpolicy controller software330 may permit transmission of the document (block485), as discussed above forFIG. 4C.

While the implementations shown inFIGS. 4C and 4D are shown as separate implementations, these implementations may be combined into a single implementation.

Examples

There are a number of ways to implement the aspects of the present invention.FIGS. 5 and 6 are diagrams of a few exemplary implementations for providing network endpoint software that identifies and processes confidential information using one or more desktop search engine software packages. The search results may be used to prevent leakage of confidential information from a specific network endpoint, and to educate the network so as to prevent other network endpoints from transmitting the same or similar confidential information.

Policy Enforcement

FIG. 5 is a diagram of an exemplary implementation for performing the enforcement aspect in an exemplary network500. Network500 may includeclient110 connected toorganizational network180 vianetwork device120.Organizational network180 may includepolicy server130 andrule generator150 connected toprivate network160.Client110 may also be connected toISP server140 andexternal client110 viapublic network170.

Client110 may have afile510 that contains content not allowed under existing policy rules, and afile520 that contains allowable content under existing policy rules. Bothfiles510,520 may be processed in accordance with the aspects ofFIG. 4C to determine whether transmission offiles510,520 should be permitted or selectively permitted. In accordance withFIG. 4C, file510 may be prevented from being transmitted outside the organizational network180 (i.e., blocked) because it violates policy rules (530).File510 may also be flagged (andorganizational network180 notified), be prevented from being transmitted withinorganizational network180, and/or have other restrictions placed upon it. Further in accordance withFIG. 4C, file520 may be transmitted within and/or outside the organizational network (540) because it does not violate policy rules.

File510 may be further processed. For example, the user ofclient110 may be informed what is happening to file510 (e.g., blocked, quarantined, deleted, etc.). The user ofclient110 may be informed how to legitimately distribute file510 (e.g., may only send to certain users, may only use internally, etc.).

Searching, Policy Updating, and Policy Enforcement

FIG. 6 is a diagram of an exemplary implementation for performing the searching, updating, and enforcement aspects in an exemplary network600. Network600 may includeclient110 connected toorganizational network180 vianetwork device120.Organizational network180 may includepolicy server130 andrule generator150 connected toprivate network160.Client110 may also be connected toISP server140 andexternal client110 viapublic network170.

Client110 may have a file or files610 that were located in a search ofclient110 in accordance with the aspects ofFIG. 4A. For example, file(s)610 may have been located onclient110 by selecting a search engine(s) on client110 (block415 ofFIG. 4A); by choosing search terms based on policy rules (block420 ofFIG. 4A); by analyzing the search result(s) against policy rules (block430 ofFIG. 4A); and/or by identifying search result(s) likely containing confidential information (block435 ofFIG. 4A).

File(s)610 may be processed in accordance with the aspects ofFIG. 4B. For example, it may be determined whether file(s)610 are on the “blacklist” (block445 ofFIG. 4B). File(s)610 retrieved after this process may be analyzed directly bypolicy controller software330 or may be sent to rulegenerator150 for analysis (620).Software330 and/orrule generator150 may use file(s)610 as training data (block455 ofFIG. 4B) to generate new policy rules and/or modify existing policy rules (block460 ofFIG. 4B).

Rule generator150 may receive file(s)610 and use them as training data for, e.g., a model, that decides whether and how to update policy rules. In one implementation,rule generator150 may collect information regarding new file(s)610 that have been identified as likely containing confidential information from a number of clients.Rule generator150 may use this information as training data for generating new policy rules and/or modifying existing policy rules, which may be referred to as updated policy rules640.

In one implementation,software330 may transmit updated policy rules640 to other clients, via, e.g.,policy server130 or internal network160 (block465 ofFIG. 4B). In another implementation, the results630 ofrule generator150 may be sent topolicy server130.Policy server130, in turn, may transmit updated policy rules640 to all devices utilizing organizational network180 (block465 ofFIG. 4B). For example,policy server130 may provide updated policy rules640 to a group ofclients110 attached to network180 (e.g., clients associated with organization network180).

File(s)610 may be processed in accordance with the aspects ofFIGS. 4C and 4D. For example,policy controller software330 may detect a user attempting to transmit file(s)610 (block470 ofFIGS. 4C and 4D); determine whether file(s)610 is on the “blacklist” (block475 ofFIG. 4C); analyze file(s)610 against the policy rules and/or updated policy rules (block490 ofFIG. 4D); and/or determine whether file(s)610 violates the policy rules and/or updated policy rules (block495 ofFIG. 4D).Policy controller software330 running onclient110 may determine (in accordance withblocks480 and485 ofFIGS. 4C and 4D) whether to selectively permit transmission and/or permit transmission of file(s)610 based upon the policy rules and/or updated policy rules (650).

CONCLUSION

Implementations consistent with the principles of the invention may relate to identifying and processing confidential information stored on network endpoints using one or more desktop search engine software packages. The search results may be used to prevent transmission of confidential information on a specific network endpoint, and to educate the network so to prevent other network endpoints from transmitting the same or similar confidential information.

The foregoing description of preferred embodiments of the invention provides illustration and description, but is not intended to be exhaustive or to limit the invention to the precise form disclosed. Modifications and variations are possible in light of the above teachings or may be acquired from practice of the invention.

For example, while a series of acts has been described with regard toFIGS. 4A-4D, the order of the acts may differ in other implementations consistent with the principles of the invention. Also, non-dependent acts may be performed in parallel.

Although the identification of documents (e.g., files) created by the network endpoint was discussed, the principles of the invention may apply to content inadvertently stored on a network endpoint. For example, if a network endpoint inadvertently downloaded a virus via the Internet, the present invention may identify such a virus and block its distribution throughout the organizational network.

It will also be apparent to one of ordinary skill in the art that aspects of the invention, as described above, may be implemented in many different forms of software, firmware, and hardware in the implementations illustrated in the figures. The actual software code or specialized control hardware used to implement aspects consistent with the principles of the invention is not limiting of the present invention. Thus, the operation and behavior of the aspects were described without reference to the specific software code—it being understood that one of ordinary skill in the art would be able to design software and control hardware to implement the aspects based on the description herein.

No element, act, or instruction used in the present application should be construed as critical or essential to the invention unless explicitly described as such. Also, as used herein, the article “a” is intended to include one or more items. Where only one item is intended, the term “one” or similar language is used. Further, the phrase “based on” is intended to mean “based, at least in part, on” unless explicitly stated otherwise.

Claims (14)

1. A computer-readable memory device including instructions executable by at least one processor, the computer-readable memory device comprising: one or more instructions to determine an availability of a plurality of search engines in a device; one or more instructions to select a search engine determined to be available from the plurality of search engines; one or more instructions to input a search term based on a set of policy rules into the selected search engine and cause the selected search engine to perform a search of the device based on the search term and to output search results; one or more instructions to analyze the search results output from the selected search engine against the set of policy rules; and one or more instructions to identify the search results that include confidential information based on the analysis of the search results against the set of policy rules.

2. The computer-readable memory device ofclaim 1, further comprising: one or more instructions to cause the selected search engine to perform the search on a periodic basis, when a user closes an application in the device, or when the user stops typing information into the device.

3. The computer-readable memory device ofclaim 1, further comprising: one or more instructions to form or update a list of documents that violate the set of policy rules based on the identified search results that include confidential information.

4. The computer-readable memory device ofclaim 1, further comprising: one or more instructions to determine whether one of the search results is included in a list of documents that violate the set of policy rules; one or more instructions to use the one of the search results identified as containing confidential information but not included in the list of documents that violate the set of policy rules to formulate updated policy rules; and one or more instructions to transmit the updated policy rules.

5. The computer-readable memory device ofclaim 4, further comprising: one or more instructions to selectively permit transmission of a document included in the list of documents that violate the set of policy rules and permit transmission of a document not included in the list of documents that violate the set of policy rules.

6. The computer-readable memory device ofclaim 4, further comprising: one or more instructions to determine whether a document violates the updated policy rules; and one or more instructions to selectively permit transmission of the document when the document violates the updated policy rules, and permit transmission of the document when the document does not violate the updated policy rules.

7. The computer-readable memory device ofclaim 1, further comprising: one or more instructions to transmit the identified search results that include confidential information to an external device for formulating updated policy rules.

8. An automated method for identifying confidential information, performed by a computing device, the method comprising: inputting, by a processor of the computing device, a search term based on a set of policy rules into a search engine; causing, by the processor, the search engine to perform a search based on the search term; analyzing, by the processor, search results obtained from the search engine against the set of policy rules to identify one of the search results that includes confidential information; determining, by the processor, whether the one of the search results is included in a list of documents that violate the set of policy rules; and updating, by the processor and when it is determined that the one of the search results is not included in the list of documents that violate the set of policy rules, the list to include the one of the search results.

9. The automated method ofclaim 8, further comprising: causing the search engine to perform the search on a periodic basis, when a user closes an application in the computing device, or when the user stops typing into the computing device.

10. The automated method ofclaim 8, further comprising: transmitting the one of the search results identified as including confidential information to an external device for formulating updated policy rules.

11. The automated method ofclaim 8, further comprising: repeatedly inputting another search term based on the set of policy rules into the search engine and causing the search engine to perform another search based on the other search term.

12. The automated method ofclaim 8, further comprising: using the one of the search results that includes confidential information but not included in the list of documents that violate the set of policy rules to formulate updated policy rules; and transmitting the updated policy rules.

13. The automated method ofclaim 12, further comprising: selectively permitting transmission of a document included in the list of documents that violate the set of policy rules and permitting transmission of a document not included in the list of documents that violate the set of policy rules.

14. The automated method ofclaim 12, further comprising: determining whether a document violates the updated policy rules; and selectively permitting transmission of the document when the document violates the updated policy rules and permitting transmission of the document when the document does not violate the updated policy rules.

Images